2,374 reputation
11019
bio website
location
age
visits member for 2 years, 11 months
seen 1 min ago

Sep
2
comment Do salts have to be random, or just unique and unknown?
let us continue this discussion in chat
Sep
1
comment Do salts have to be random, or just unique and unknown?
@MisterMelancholy "unknown" "entropy" I think you need to check the definition of "entropy". It does not mean "I don't know the answer", it is bound on the probability of correctly guessing the answer with x tries. Practically, a lot of entropy means you cannot guess the correct answer, ever, even if you try as much as you can in a lifetime.
Aug
28
comment How can I implement DVD copy protection?
@FakeRainBrigand This is a general principle. For any standard protection method that is not so good, since there is market and it is doable, there will be a tool, it will be available on the Internet, and people with zero CS knowledge will be able to use it.
Aug
27
comment Please help verify my understanding of Domain Validation (DV) SSL Certificate
What about a browser who has just seen an EV certificate, who sees another cert?
Aug
27
comment Please help verify my understanding of Domain Validation (DV) SSL Certificate
"An EV certificate will protect you against sloppy CA only as long as your clients are trained to pause and become suspicious if they see a seemingly valid but non-EV certificate bearing your site name." and by client, you mean client software, right?
Aug
27
comment What does capture filter means in wireshark?
Libpcap filter syntax may not be user friendly, but on a busy interface, you probably need to learn it if you don't want to deal with huge capture files.
Aug
26
comment Password management in Firefox, Chrome and Safari
Are you assume a "one strike" attack (you get once the control of the logged-in computer)? Can you come back? Can you install software?
Aug
26
comment Password management in Firefox, Chrome and Safari
I knew I was going to see this question about the outrage about nothing.
Aug
19
comment Can malware come in any format?
You can rename a PDF file with a .txt extension and try to open it in a text editor, but I doubt it will do much good.
Aug
8
comment Secure Session Cookies
I think you are confusing "Non-repudiation" and integrity.
Aug
8
comment Secure Session Cookies
@symcbean "Browsers vary in whether they manage cookies in a central store" which browsers do not behave as if they used a central cookie store? (Using "private mode" and multiple "profiles" do not count, any functionality intended to change your online identity and session state do not count.)
Aug
8
comment Is a cookie safer than a simple HTTP header?
@Joshua "If an attacker injects an image, javascript" If the attacker can inject JS, then he just controls the webpage. He does not need the capture a Referer. He can read (even capturing form data) and modify any part of the page (displaying incorrect information to the user, or changing form data just before submission), and retrieve any cookie not marked HTTPOnly, and do anything on behalf of the user.
Aug
8
comment Is a cookie safer than a simple HTTP header?
"Safe" is a meaningless term, just as "secure". You have to define a context: who is your adversary? Do you consider the possibility of wiretapping? Do you consider a website with user supplied contain, like this very website?
Aug
8
comment Is a cookie safer than a simple HTTP header?
@lynks The Referer contains the whole URL as sent to the HTTP server. It does not contain the local part after the #.
Aug
8
comment Is a cookie safer than a simple HTTP header?
1: You (the webmaster) control the outbound links. If you can manage to have only links to sites under your control, 1. is not a problem. 2: Who implements Cookie2?
Aug
8
comment wpa2-psk + wireless isolation = secure connection?
It there a standard definition of "isolation"?
Jul
14
awarded  Nice Answer
Jul
9
comment How is HTTP PUT and DELETE methods insecure, if they really are?
@Adnan "Really?" No, not really.
Jul
9
comment How is HTTP PUT and DELETE methods insecure, if they really are?
@LucasKauffman -1; SFTP is a part of SSHv2.
Jul
9
comment How is HTTP PUT and DELETE methods insecure, if they really are?
"or even GET /users/1/delete." be careful with GET which is supposed to not have side effects.